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declaration, 1 hereby invoke and assert the NSA’s statutory privilege set forth in Section 6 of the 
National Security Agency Act of 1959, Public Law No. 86-36 (codified as a note to 50 U.S.C. 

§ 402) (“NSA Act"), to protect the information related to NSA activities described herein below. 
The statements made herein are based on my personal knowledge of NSA activities and 
operations, and on information made available to me as (he Chief of Staff of the NSA. 

II. (U) Summary 

3 (U) In the course of my official duties. 1 have been advised of this litigation and 1 

have reviewed the allegations in the Complaint in this case. In sum, plaintiffs allege that, after 
the 9/1 1 attacks, the NSA received presidential authorization to engage iD surveillance activities 
far broader than the publicly acknowledged ‘Terrorist Surveillance Program” (‘TSP”), which 
involved the interception of specific international communications involving persons reasonably 
believed to be associated with al Qaeda and affiliated terrorist organizations. Plaintiffs allege 
that the NSA, with the assistance of telecommunication companies including AT&T, has 
indiscriminately intercepted the content and obtained the communications records of millions of 
ordinary Americans as part of an alleged president! ally-authorized “Program" after 9/1 1 . See 
Complaint at 2-13; 39-97. 1 cannot disclose on the public record the nature of any NSA 
information implicated by the plaintiffs’ allegations. However, as described further below, the 
disclosure of information related to the NSA’s activities, sources and methods implicated by the 
plaintiffs’ allegations reasonably could be expected to cause exceptionally grave damage to the 
national security of the United States and, for this reason, are encompassed by the DNI’s state 
secrets and statutory privilege assertions, as well as by my assertion of the NSA statutory 
privilege, and should be protected from disclosure in this case. In addition, il is my judgment 
that sensitive state secrets are so central to the subject matter of the litigation that any attempt to 
proceed in the case risks the disclosure of the classified privileged national security information 
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described herein and exceptionally grave damage to the national security of the United States. 



4. f TS /ZTSP /Z S l/ZOC/N P) The allegations in this lawsuit put at issue the disclosure 
of information concerning several highly classified and critically important NSA intelligence 
activities that commenced after the 9/1 1 terrorist attacks, but which are now conducted pursuant 
to authority of the Foreign Intelligence Surveillance Act (“FISA”), including ongoing activities 
conducted under orders approved by the Foreign Intelligence Surveillance Court (“FISC”). 
Plaintiffs’ allegation that the NSA undertakes indiscriminate surveillance of the content' of 
millions of communications sent or received by people inside the United States— under the now 
defimct-TSP or otherwise — is false, as discussed below. The NSA’s collection of the content of 
communications under the TSP was directed at intemationaJ communications in which a 
participant was reasonably believed to be associated with al Qaeda or an affiliated organization 
and did not constitute the kind of dragnet collection of the content of millions of Americans’ 
telephone or Internet communications that the plaintiffs allege. Although the existence of the 
TSP has been acknowledged, the details of that program remain highly classified, along with 
details of related content surveillance activities undertaken after the TSP pursuant to orders of 
the FISC. This information could not be disclosed to address or disprove or otherwise litigate 
the plaintiffs’ allegation of a content dragnet without causing exceptional harm to NSA’s sources 
and methods of gathering intelligence — including methods currently used to detect and prevent 
further terrorist attacks under the authority of the FISA. 

5. (TS//T SF// S&/QC/NF ) In addition, as the Court should also be aware from prior 
classified declarations submitted by the NSA in related proceedings, the NSA has collected, 
pursuant to presidential authorization and currently under subsequent FISC orders, non-content 



-f¥S//S t//OC/Nff) The term “content” is used herein to refer to the substance, meaning, 
or purport of a communication, as defined in 1 8 U.S.C. § 251 0(8), as opposed to the type of 
addressing or routing information referred throughout this declaration as “meta data.” 
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highly sophisticated analytical tools that can uncover the contacts 



members or agents o 



As noted above and detailed 



below, the conlent surveillance subject to presidential authorization after 9/1 1 was not the 
content dragnet surveillance that plaintiffs allege, and the collection of non-contcnt information, 
while significant in scope remains a highly classified matter currently under FISA authorization. 
For the NSA to attempt to explain, clarify, disprove, or otherwise litigate plaintiffs’ allegations 
regarding a communications dragnet would require the NSA to confirm the existence of, or 
disclose facts concerning, intelligence sources and methods for (he collection of non-content 
information related to communications, as well as current NSA operations under FISC Orders — 
disclosures that would cause exceptional harm to national security. 

In addition, plaintiffs’ allegation that 
telecommunications carriers, in particular AT&T, assisted the NSA in alleged intelligence 
activities cannot be confirmed or denied without risking exceptionally grave harm to national 
security. Because the NSA has not undertaken the alleged dragnet collection of communications 
content, no carrier has assisted in that alleged activity. 




ISC Orders are also directed at| 

Because the allegations in the complaint reference activities 



.a am 

further references to the FISC Orders will foc us solely on activities under the orders directed at 
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| would cause exceptionally grave damage to the 

national security. 

7. (TS//Sl-|^|j§'^FSP//©€/NF>Accordingly, the DNI’s state secrets and 
statutory privilege assertions, and my own statutory privilege assertion, seek to protect against 
the disclosure of the highly classified intelligence sources and methods put at issue in this case 
and vital to the national security of the United States, including: (1) any information that would 
tend to confirm or deny whether particular individuals, including the named plaintiffs, have been 
subject to the alleged NSA intelligence activities; (2) information concerning NSA intelligence 
sources and methods, including facts demonstrating that the content collection under the TSP 
was limited to specific al Qaeda and associated terrorist-related international communications 
and was not a content surveillance dragnet as plaintiffs allege; (3) facts that would tend to 
confirm or deny the existence of the NSA's bulk meta data collection and use, and any 
information about those activities; and (4) the fact that] 

| The fact that there has been public speculation 
about alleged NSA activities does not diminish the need to protect intelligence sources and 
methods from further exposure. Official confirmation and disclosure of the classified privileged 
national security information described herein would cause exceptionally grave damage to the 
notional security. For these reasons, as set forth further below, 1 Tequest that the Court uphold 
the state secrets and statutory privilege assertions that the DNI and I now make, and protect the 
information described in this declaration from disclosure. 
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8. -(S&S-LWF) Xhis declaration is classified TOP SECRET//TSP//SI-ECI 
JUoRCON/NOFORN pursuant to the standards in Executive Order No. 12958, as amended ' 
by Executive Order No. 13292. Under Executive Order No. 12958, information is classified 
“TOP SECRET’ if unauthorized disclosure of the information reasonably could be expected to 
cause exceptionally grave damage to the national security of the United States; "SECRET” if 
unauthorized disclosure of the information reasonably could be expected to cause serious 
damage to national security, and “CONFIDENTIAL" if unauthorized disclosure of the 
information reasonably could be expected to cause identifiable damage to national security. At 
the beginning of each paragraph of this declaration, the letter or letters in parentheses 
designated) the degree of classification of the information the paragraph contains. When used 
for this purpose, the letters “TJ,” “C,” “S,” and “T$” indicate respectively that the information is 
either UNCLASSIFIED, or is classified CONFIDENTIAL, SECRET, or TOP SECRET 3 . 

9. -fSf'/StiWFT Additionally, this declaration also contains Sensitive Compartmented 
Information (SCI), which is “information that not only is classified for national security reasons 
as Top Secret, Secret, or Confidential, but also is subject to special access and handling 
requirements because it involves or derives from particularly sensitive intelligence sources and 
methods.” 28 C.F.R. § 17.18(a). Because of the exceptional sensitivity and vulnerability of such 
I information, these safeguards and access requirements exceed the access standards that are 
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normally required for information of the same classification level. Specifically, this declaration 
references communications intelligence (COMrNT), also referred to as special intelligence (SI), 
which is a subcategory of SCI. COMfNT or SI identifies SCI that was derived from exploiting 
cryptographic systems or other protected sources by applying methods or techniques, or from 
intercepted foreign communications. 

10. This declaration also contains information 

related to or derived from the Terrorist Surveillance Program (TSP), a controlled access signals 
intelligence program under presidential authorization in response to the attacks of September 1 1 , 
2001 . Although TSP was publicly acknowledged hy then-President Bush in December 2005, 



details about the program remain highly classified and strictly compartmented. information 
pertaining to this program is denoted with the special marking 'TSP” and requires more 




1 1 . -fS/ZS iy/NF ) In addition to the fact that classified information contained herein 
may not be revealed to any person without authorization pursuant to Executive Order 12958, as 
amended, this declaration contains information that may not be released to foreign governments, 
foreign nationals, or non-U .S. citizens without permission of the originator and m accordance 
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with DNI policy. This information is labeled “NOFORN.” The “ORCON” designator means 
that the originator of the information controls to whom it is released. 

IV. CUt Background Information 
A. (U) The National Security Agency 

12. (U) The NS A was established by Presidential Directive in 1 952 as a separately 
organized agency within the Department of Defense. The NSA’s foreign intelligence mission 
includes the responsibility to collect, process, analyze, produce, and disseminate signals 
intelligence (SIGINT) information, of which communications intelligence (“COMINT”) is a 
significant subset, for (a) national foreign intelligence purposes, (b) counterintelligence purposes, 
and (c) the support of military operations. See Executive Order 12333, § 1.7(c), as amended/ 

1 3. -fFStfSJ) Signals intelligence (SIGINT) consists of three subcategories: 

(1) communications intelligence (COMINT); (2) electronic intelligence (ELINT); and (3) foreign 
instrumentation signals intelligence (FISINT). Communications intelligence (COMINT) is 
defined as “all procedures and methods used in the interception of communications and the 
obtaining of information from such communications by other than the intended recipients.” 1 8 
U.S.C. § 798. COMTNT includes information derived from the interception of foreign and 
international communications, such as voice, facsimile, and computer-to-computer information I 
conveyed via a number of means 

Electronic intelligence (ELINT) is technical intelligence information derived from 
foreign non-communications electromagnetic radiations except atomic detonation or radioactive 
sources-in essence, radar systems affiliated with military weapons platforms ( e.g ., anti-ship) and 
civilian systems (e.g., shipboard and air traffic control radars). Foreign instrumentation signals 



(U) Section 1.7(c) ofE.O. 12333, as amended, specifically authorizes the NSA to 
“Collect (including through clandestine means), process, analyze, produce, and disseminate 
signals intelligence information for foreign intelligence and counterintelligence purposes to 
support national and departmental missions.” 
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intelligence (F1SINT) is derived from non-U. S. aerospace surfaces and subsurface systems which 

may have either military or civilian applications. 

14. The NSA's SIGINT responsibilities include establishing and 
operating an effective unified organization to conduct SIGINT activities set forth in Executive 
Order No. 12333, § 1.12(b), as amended. In performing its SIGINT mission, NSA has 
developed a sophisticated worldwide SIGfNT collection network that acquires, among other 
things, foreign and international electronic communications and related information. The 
technological infrastructure that supports the NSA’s foreign intelligence information collection 
network has taken years to develop at a cost of billions of dollars and untold human effort. It 
relies on sophisticated collection and processing technology. 

1 5. (U) There are two primary reasons for gathering and analyzing foreign 
intelligence information. The first, and most important, is to gain information required to direct 
U S. resources as necessary to counter external threats and in support of military operations. The 
second reason is to obtain information necessary to the formulation of U.S. foreign policy. 
Foreign intelligence information provided by the NSA is thus relevant to a wide range of 
important issues, including military order of battle; threat warnings and readiness; arms 
proliferation; international terrorism; counter-intelligence; and foreign aspects of international 
narcotics trafficking. 

16. -fS // 6F /N F)The NSA's ability to produce foreign intelligence information 
depends on its access to foreign and international electronic communications. Foreign 
intelligence produced by COMINT activities is an extremely important part of the overall foreign 
intelligence information available to the United Slates and is often unobtainable by other means. 
Public disclosure of either the capability to collect specific communications or the substance of 
the information derived from such collection itself can easily alert targets to the vulnerability of 
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their communications. Disclosure of even a single communication holds the potential of 
revealing intelligence collection techniques that are applied against targets around the world. 
Once alerted, targets can frustrate COMINT collection by using different or new encryption 
techniques, by disseminating disinformation, or by utilizing a different communications link. 
Such evasion techniques may inhibit access to the target’s communications and therefore deny 
the United States access to information crucial to the defense of the United States both at home 
and abroad. COMINT is provided special statutory protection under 18 U.S.C. § 798, which 
makes it a crime to knowingly disclose to an unauthorized person classified information 
“concerning the communication intelligence activities of the United States or any foreign 
government.” 

B. (U) September 11, 2001 and the al Qaeda Threat 

17. (U) On September \ 1, 2001, the al Qaeda terrorist network launched a set of 

coordinated attacks along the East Coast of the United States. Four commercial jetliners, each 
carefully selected to be fully loaded with fuel for a transcontinental flight, were hijacked by al 
Qaeda operatives. Those operatives targeted the Nation's financial center in New York with two 
of the jetliners, which they deliberately flew into the Twin Towers of the World Trade Center. 

Al Qaeda targeted the headquarters of the Nation’s Armed Forces, the Pentagon, with the third 
jetliner. Al Qaeda operatives were apparently headed toward Washington, D.C. with the fourth 
jetliner when passengers struggled with the hijackers and the plane crashed in Shanksville, 
Pennsylvania. The intended target of this fourth jetliner was most evidently the White House or 
the Capitol, strongly suggesting that al Qaeda's intended mission was to strike a decapitation 
blow to the Government of the United States— to kill the President, the Vice President, or 
Members of Congress. The attacks of September 1 1 resulted in approximately 3,000 deaths — 
the highest single-day death toll from hostile foreign attacks in the Nation’s history. In addition, 
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these attacks shut down air travel in the United States, disrupted the Nation’s financial markets 

and government operations, and caused billions of dollars of damage to the economy. 

18. (ll) On September 14, 2001 , a national emergency was declared “by reason of the 
terrorist attacks at the World Trade Center, New York, New York, and the Pentagon, and the 
continuing and immediate threat of further attacks on the United States.” Presidential 
Proclamation No. 7463, 66 Fed. Reg. 48199 (Sept. 14, 2001). The United Stales also 
immediately began plans for a military response directed at al Qaeda’s training grounds and 
havens in Afghanistan. On September 14, 2001 , both Houses of Congress passed a Joint 
Resolution authorizing the President of the United States “to use all necessary and appropriate 
force against those nations, organizations, or persons he determines planned, authorized, 
committed, or aided the terrorist attacks” of September 1 1 . Authorization for Use of Military 
Force, Pub. L. No. 107-40 § 21(a), 115 Stat. 224,224 (Sept. 18, 2001) (“Cong. Auth.”). 

Congress aJso expressly acknowledged that the attacks rendered it “necessary and appropriate” 
for the United States to exercise its right “to protect United States citizens both at home and 
abroad,” and acknowledged in particular that “the President has authority under tbe Constitution 
to take action to deter and prevent acts of international terrorism against the United States.” Id. 
pmbl. 

19. (U) Also after the 9/1 1 attacks, a Military Order was issued stating that the attacks 
of September 1 1 “created a slate of armed conflict,” see Military Order by the President § 1(a), 

66 Fed. Reg. 57833, 57833 (Nov. 13, 2001), and that al Qaeda terrorists “possess both the 
capability and the intention to undertake further terrorist attacks against the United States that, if 
not detected and prevented, will cause mass deaths, mass injuries, and massive destruction of 
property, and may place at risk the continuity of the operations of the United Stales 
Government,” and concluding that “an extraordinary emergency exists for national defense 
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purposes.” Military Order, § 1(c), (g), 66 Fed. Reg. at 57833-34. Indeed, shortly after the 
attacks, on October 2, 2001 , NATO took the unprecedented step of invoicing Article 5 of the 
North Atlantic Treaty, which provides that an “armed attack against one or more of [the parties] 
shall be considered an attack against them all.” North Atlantic Treaty, Apr. 4, 1949, art. 5, 63 
Stat. 2241, 2244, 34 U.N.T.S. 243, 246. 

20. (U) As a result of the unprecedented attacks of September 1 1 , 2001 , the United 
States found itself immediately propelled into a worldwide war against a network of terrorist 
groups, centered on and affiliated with al Qaeda, that possesses the evolving capability and 
intention of inflicting further catastrophic attacks on the United States. That war is continuing 
today, at home as well as abroad. Moreover, the war against al Qaeda and its allies is a different 
kind of war, against a very different enemy, than any other war or enemy the Nation has 
previously faced. Al Qaeda and its supporters operate not as a traditional nation-state but as a 
diffuse, decentralized global network of individuals, cells, and loosely associated, often disparate 
groups, that act sometimes in concert, sometimes independently, and sometimes in the United 
States, but always in secret — and their mission is to destroy lives and to disrupt a way of life 
through terrorist acts. Al Qaeda works in the shadows, secrecy is essential to al Qaeda’s success 
in plotting and executing its terrorist attacks. 

2 1 . (TS/ZS - IZ/N f ) The Classified In Camera , Ex Parte Declaration of Admiral Dennis 
C. Blair, Director of National Intelligence, details the particular facets of the continuing al Qaeda 
threat and, thus, the exigent need for the NSA intelligence activities described here. The NSA 
activities arc directed at that threat,! 



Global telecommunications networks, especially the Internet, have 
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t developed in recent years into a loosely interconnected system — a network of networks — that is 

2 ideally suited for the secret communications needs ofloosely affiliated terrorist cells. Hundreds 

3 oflntemet service providers, or “ISPs,” and other providers of communications services offer a 



wide variety of global communications options, often free of charge. 





23. fP5tfSi // 0 €/NF) Our efforts against at Qaeda and its affiliates therefore present 
critical challenges for the Nation’s communications intelligence capabilities. First, in this new 
kind of war, more than in any other we have ever faced, communications intelligence is essential 
to our ability to identify the enemy and to detect and disrupt its plans for further attacks on the 
United States. Communications intelligence often is the only means we have to learn the 
identities of particular individuals who are involved in terrorist activities and the existence of 
particular terrorist threats. Second, at the same time that communications intelligence is more 
important than ever, the decentralized, non-hierarchical nature of the enemy and their 
sophistication in exploiting the agility of modem telecommunications make successful 
communications intelligence more difficult than ever. It is against this backdrop that the risks 
presented by this litigation should be assessed, in particular the risks of disclosing particular 
NSA sources and methods implicated by the claims. 

C. (U) Summary of NSA Activities After 9/11 to Meet al Qaeda Threat 

24. (TS//S f// Q C/NF) After the September 1 1 attacks, the NSA received presidential 
authorization and direction to detect and prevent further terrorist attacks within the United States 
by intercepting the content of telephone and Internet communications for which there were 
reasonable grounds to believe that (1) such communications originated or terminated outside the 
United States and (2) a party to such communication was a member or agent of al Qaeda or an 
affiliated terrorist organization. The existence of this activity was disclosed by then-President 
Bush in December 2005 (and subsequently referred to as the “Terrorist Surveillance Program” or 
“TSP’V 



7 (U) On January 17, 2007, the Attorney General made public the general facts that new 
orders of the Foreign Intelligence Surveillance Court had been issued that authorized the 
Government to target for collection international communications into or out of the United States 
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25. fTSff : rSIVi t SI # 00/N r) In more specific and classified terms, the NSA has 
utilized a number of critically important intelligence sources and methods to meet the threat of 
another mass casualty terrorist attack on the United States — methods that were designed to work 
in tandem and continue to this day under authority of the FISC. As noted above, one such 
method involved the program publicly acknowledged by then-President Bush as the TSP, in 
which the NSA intercepted the content of telephone and Internet communications pursuant to 
presidential authorization * As described further below, under the TSP, NSA did not engage in 
plaintiffs’ alleged dragnet surveillance of communication content, but intercepted the content of 
particular communications where reasonable grounds existed to believe one party involved a 
member of agent or al Qaeda or affiliated terrorist organization based on particular ‘'selectors” 
(phone numbers or Internet addresses) associated with that target. In addition to collecting the 
content of particular communications, the NSA has also collected non-content communication 
information known as “meta data.” Specifically, after the 9/1 1 attacks, the NSA collected bulk 
meta data related to telephony communications for the purpose of conducting targeted analysis to 



where there is probable cause to believe that one of the communicants is a member or agent of al 
Qaeda or an associated terrorist organization; that, as a result of these orders, any electronic 
surveillance that had been occurring as part of the TSP was then being conducted subject to the 
approval of the FISA Court, and that, under these circumstances, the TSP was not reauthorized. 



O .1 i , 

frSf/TSPWS #/€>€/NF) The first presidential authorization of the TSP was on October 
4, 2001 , and the TSP was reauthorized approximately every 30-60 days throughout the existence 
of the program. The documents authorizing the TSP also contained the authorizations for the 
meta data activities described herein. The authorizations, moreover, evolved over time, and 
during certain periods authorized other activities (this declaration is not intended to and^oes not 
fully describe the authorizations and the differences in those authorizations over time 
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Telephony meta data is information derived from call detail 

records that reflect non-content information such as, but not limited to, the date, time, and 

duration of telephone calls, as well as the phone numbers used to place and receive the calls. 9 In 

addition, since the 9/1 1 attacks, the NS A has collected bulk meta data related to Internet 

communications. Internet meta data is header/router/addressing information, such as the “to,” 

“from,” “cc,” and “bcc” lines, as opposed to the body or “re” lines, of a standard email 

26. (T S/ ZS I Z/ O O/N Ff Each of the foregoing activities continues in some form under 

authority of the FISA and, thus, the NSA utilizes the same intelligence sources and methods 

today to detect and prevent further terrorist attacks that it did after the 9/1 1 attacks. First, as 

noted above, on January 1 0, 2007, the FISC issued two orders authorizing the Government to 

conduct certain electronic surveillance that had been occurring under the TSP. The FISC Orders 

were implemented on January 17, 2007 and, thereafter, any electronic surveillance that had been 

occurring as part of the TSP became subject to the approval of the FISC and the TSP was not 

reauthorized. 10 



fTS/ZST'/ OC/N F) As also described further (1fi| 64-67 infra), the FISC has extended 
these orders with some modifications, and the Foreign Telephone and Email Order later expired 
in August 2007 and was supplanted by authority enacted by Congress first under the Protect 
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27. fTStfSi /Z OC/ N F ) Second, witlHespecUo the collection of telephony meta data, 
since May 2006 certain telecommunication providers have been required by an order of the FISC 
to produce to the NS A on a daily basis all telephony meta data that they create (“FISC Telephone 
Business Records Order”). The FISC Telephone Business Records Order has been reauthorized 
approximately every 90 days since it was first issued. Although this collection is broad in scope, 
the NSA was authorized by the FISC to query the archived telephony data with identified 
telephone numbers for which there are facts giving rise to a reasonable, articulable suspicion that 



the number is associated with 



(hereafter referred to 



as a “RAS” determination). 1 1 Historically, only a tiny fraction of telephony meta data records 
collected by the NSA has actually been presented to a trained professional for analysis. As 
discussed further below (see 49-57 infra), while the vast majority of records are thus never 
viewed by a human at the NSA, it is still necessary to collect the meta data in bulk in order to 
utilize sophisticated and vital analytical tools for tracking the contacts 

for protecting the national security of the United States. 



I America Act and then the FISA Amendments Act of 2008 to authorize foreign intelligence 
: surveillance of targets located overseas without individual court orders. 

11 (TSf/S l//0€/ NF) As set forth further below 61-63 infra), NSA’s compliance with 
this limitation in the FISC Order has been subject to further proceedings in the FISC that 
commenced with a compliance report by the government on January 1 5, 2009, which indicated 
that the NSA had also been querying incoming telephony meta data with selectors for 
counterterrorism targets subject to NSA surveillance under Executive Order 12333, as to which 
the NSA had not made a “RAS” determination. On March 2, 2009, the FISC renewed the Order 
authorizing the bulk provisioM^S^oHjusmess records containing telephony meta data from 
telecommunications subjected that activity to new limitations, 

including that the NSA may query the meta data only after a motion is granted on a case-by-case 
basis (unless otherwise necessary to protect against imminent threat to human life). The FISC 
also required the Government to report to the FiSC on its review of revisions to the meta data 
collection and analysis process, and that report shall include affidavits describing the value of the 
collection of telephony meta authorized by the FISC Telephone Business Records Order. 
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28. fPStfSl // OC/NF) Third, beginning in July 2004, the collection of Internet meta 

data in bulk has been conducted pursuant to an order of the FISC authorizing the use of a pen 
register and trap and trace device (“FISC Pen Register Order" or “PRTT Order”). See 58 U.S.C. 
§ 3 127 (defining “pen register" and “trap and trace device"). Pursuant to the FISC Pen Register 
Order, which has been reauthorized approximately every 90 days since it was first issued, the 
NSA is authorized to collect, in bulk, meta data associated with electronic communications 



n the Internet. 12 



Although the NSA collects email meta data id bulk 
it has been authorized by the FISC to query the archived meta data only using email 
addresses for which there are facts giving rise to a reasonable, articulable suspicion that the emai 



address is associated with 



(similar restrictions were 



in place under the presidential authorization). As with bulk telephony meta data collection, bulk 
Internet meta data collection is necessary to allow the NSA to use critical and unique analytical 



capabilities to track the contacts (even retrospectively) 



f known 



terrorists. Like telephony meta data activities, Internet meta data collection and analysis are vital 
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AT&T communication cmnszKimnal records as alleged in 
the Complaint; see, e.g. r Complaint 10; 82-97, and 

(iii) Information that may tend to confirm or deny 
whether AT&T (and to die extent relevant or necessary, 
any other telecommunications carrier), has provided 
assistance to the NSA in connection with any alleged 
activity. 

VI. (11) Description of Information Subject to Privilege and the Harm of Disclosure 



A. (11) Information That May Tend to Confirm or Deny Whether the Plaintiffs Have 
Been Subject to Any Alleged NSA Activities. 

30. (U) The first major category of information as to which 1 am supporting the DN1 ’ 

assertion of privilege, and asserting the NSA ’s own statutory privilege, concerns information as 
to whether particular individuals, including the named plaintiffs in this lawsuit, have been 
subject to alleged NSA intelligence activities. As set forth below, disclosure of such information 
would cause exceptionally grave harm to the national security. 



3 1 . ( TS/ / T SP //SI//OC/NF) The five named plaintiffs in this case — Tash Hcpting, 
Gregory Hicks, Carolyn Jewel, Erik Kjiutzen and Joice Walton have alleged that, pursuant to a 
presidentially authorized program after the 9/1 1 attacks, the NSA, with the assistance of AT&T, 
has acquired and continues to acquire the content of phone calls, emails, instant messages, text 
messages, web and other comm uni cations, both international and domestic, of millions of 
ordinary Americans— “practically every American who uses the phone system or the Internet” — 
including the plaintiffs, as well as private telephone and Internet transaction records of millions 
of AT&T customers, again including information concerning the plaintiffs’ telephone and 
Internet communications. See, e.g., Complaint Tj 7 > 9, 10; see also 1fl| 39-97. As set forth 
herein, the NSA does not engage in “dragnet” surveillance of the content of communications as 
plaintiffs allege. 
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34. (U) As a matter of course, the NSA cannot publicly confirm or deny whether any 

individual is subject to surveillance activities because to do so would tend to reveal actual 



, 9 targets. For example, if the NSA were to confirm in this case and others that specific individuals 
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B, (U) Information Related to NSA Activities, Sources, or Methods Implicated by the 
Plaintiffs’ Allegations and the Harm to National Security of Its Disclosure. 

1. (I!) Plaintiffs’ Allegations of a Communications Dragnet. 



36. (U) I ara also supporting the DNI’s assertion of privilege and asserting the NSA’s 

statutory privilege over any other facts concerning NSA intelligence activities, sources, or 
methods that may relate to or be necessary to litigate the plaintiffs’ claims and allegations, 
including that (i) the NSA is indiscriminately intercepting the content of communications of 
millions of ordinary Americans, see, eg., Complaint 7, 9, 10, and (ii) that the NSA is 
collecting the private telephone and Internet transaction records of millions of AT&T customers, 
again including information concerning the plaintiffs’ telephone and Internet communications. 
See e.g.. Complaint ffl] 7, 9, 1 0, 1 3, 82-97. As described above, the scope of the government’s 
privilege assertion includes but is not limited to: ( 1 ) facts concerning the operation of the now 
inoperative Terrorist Surveillance Program and any other NSA activities needed to demonstrate 
that the TSP was limited to the interception of the content of one-end international 
communications reasonably believed to involve a member or agenl of al Qaeda or an affiliated 
terrorist organization and that the NSA docs not otherwise conduct the content surveillance 



27 

28 



dragnet that the plaintiffs allege; and (2) information concerning whether or not the NSA obtains 
transactional communication records from telecommunications companies such as AT&T as 
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plaintiffs allege. As set forth beJow, the disclosur^nuch information would cause 
exceptionally grave harm to national security. 



(«) (V) 
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37. (U) After the existence of the TSP was officially acknowledged in December 
2005, the Government stated that the NSA’s collection of the content of communications under 
the TSP was directed at international communications in which a participant was reasonably 
believed to be associated with ai Qaeda or an affiliated organisation. Plaintiffs' allegation that 
the NSA has undertaken indiscriminate surveillance of the content of millions of 
communications sent or received by people inside the United States after 9/1 1 under the TSP is 
therefore false, again as the Government has previously stated 19 But to the extent the NSA must 
demonstrate that content surveillance under the TSP was so limited, and was not plaintiffs* 
alleged content dragnet, or demonstrate (hat the NSA has not otherwise engaged in the alleged 
content dragnet, highly classified NSA intelligence sources and methods about the operation of 
the TSP and NSA intelligence activities would be subject to disclosure or the risk of disclosure. 
The disclosure of whether and to what extent the NSA utilizes certain intelligence sources and 
methods would reveal to foreign adversaries the NSA’s capabilities, or lack thereof, enabling 
them to either evade particular channels of communications that are being monitored, or exploit 
channels of communications that are not subjeci to NSA activities — in either case risking 
exceptionally grave harm to national security 

38. (U) The privileged information that must be protected from disclosure includes 
the following classified details concerning content surveillance under the now inoperative TSP. 

39. (TS//TSP//S t //OG/NP) First, interception of the content of communications 
under the TSP was triggered by a range of information, including sensitive foreign intelligence, 

,9 See, e.g.. Public Declaration of NSA Director Alexander in the Shuberi action (07-cv- 
693-VR.W) at K 16. 
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obtained or derived from various sources indicating that a particular phone number or email 

address is reasonably believed by the U.S. Intelligence Community to be associated with a 

member or agent of al Qaeda or an affiliated terrorist organization. Professional intelligence 

officers at the NSA undertook a careful but expeditious analysis of that information, and 

considered a number of possible factors, in determining whether it would be appropriate to target 

a telephone number or email address under the TSP. Those factors included whether the target 

phone number or email address was: (1) reasonably believed by the U.S. Intelligence 

Community, based on other authorized collection activities or other law enforcement or 

intelligence sources, to be used by a member or agent of al Qaeda or an affiliated terrorist 

organization; 








40. Once the NSA determined that there were reasonable 

grounds to believe that the target is a member or agent of al Qaeda or an affiliated terrorist 
organization, the NSA took steps to focus the interception on the specific al Qaeda-related target 
and on communications of that target that were to or from a foreign country. In this respect, the 



NSA’s collection efforts were 



hat the NSA had 



reasonable grounds to believe carry the "one-end" foreign communications of members or agents 
of al Qaeda or affiliated terrorist organizations. 
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foregoing information about the targeted scope of content collection under the TSP could not be 
disclosed, in order to address and rebut plaintiffs’ allegation that the NS A, with the assistance of 
AT&T, engaged in the alleged content dragnet, without revealing specific NSA sources and 
methods and thereby causing exceptionally grave damage to the national security. 



21 (U/F0W0) In addition, in implementing the TSP, the NSA applied the existing Legal 
Compliance and Minimization Procedures applicable to U.S, persons to the extent not 
inconsistent with the presidential authorization. See United States Signals Intelligence Directive 
(USS1D) 18. These procedures require that the NSA refrain from intentionally acquiring the 
communications of U.S. persons who are not the targets of its surveillance activities, that it 
destroy upon recognition any communications solely between or among persons in the U.S. that 
it inadvertently acquires, and that it refrain from identifying U.S. persons in its intelligence 
reports unless a senior NSA official determines that the recipient of the report requires such 
information in order to perform a lawful function assigned to it and the identity of the U.S. 
person is necessary to understand the foreign intelligence or to assess its significance, 

Classified In Camera. Ex Parle Declaration of Deborah A. Bonomu, NalionaJ Security Agency 3 

Carolyn Jewel, ct at. v. National Security Agency, et at. 



r nM/NA P fllj Ni 

vr«n .’T'Tvtxi’' 








I 



47. In additiorn^hese facts about the TSP, facts about other 

2 NSA intelligence activities would be needed to address or prove that the NSA does not conduct 
* the alleged content dragnet. 





In short, there is no other "dragnet” program authorized by the President after 9/1 1 

under which the NSA intercepts the content of virtually all domestic and international 

communications as the plaintiffs allege. Again, however, information about NSA content 

surveillance activities beyond the TSP could not be disclosed in order to address and rebut 

plaintiffs’ allegation without revealing specific NSA sources and methods and thereby causing 

exceptionally grave damage to national security.' 3 

(b) (U) Plaintiffs’ Allegations Concerning the Collection of Communication 
Records. 

48. (U) As noted above, plaintiffs also allege that the NSA is collecting the private 
telephone and Internet transaction records of millions of AT&T customers, again including 
infonnation concerning the plaintiffs’ telephone and Internet communications. See. e g.. 



2 f r S //TS P//S I//Oe - /NF) To the extent relevant to this case, additional facts about the 
operational details of the TSP and subsequent FISA authorized content surveillance activities 
also could noi be disclosed without exceptional barm to national security, including for example 
information that would demonstrate the operational swiftness and effective ness of utilizin 
content surveillance in conjunction with the roeta data activities. As noted 



the TSP, in conjunction with meta data 
collection and analysis described herein, allowed the NSA to obtain rapidly not only the content 
of a particular communication, but connections between that target and others who may form a 
web of al Qaeda conspirators. 
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Complaint 7, 9 , 1 0, 13, 82-97. Confirmation or denial of any information concerning whether 

the NSA collects communication records would also disclose information about whether or not 

the NSA utilizes particular intelligence sources and methods and, thus, the NSA'S capabilities or 

lack thereof, and would cause exceptionally grave harm to national security. 

49. ffS/ZS iy/OC/NF) In addition to implicating the NSA’s content collection 
activities authorized after the 9/1 1 attacks, the plaintiffs’ allegations also put directly at issue the 
NSA’s bulk collection of non-content communication meta data. As explained above, the NSA 
has not engaged in the alleged dragnet of communication content, and, as now explained below, 
to address plaintiffs’ allegations concerning the bulk collection of non-content information 
would require disclosure of NSA sources and methods that would cause exceptional harm to 
national security. As also explained herein, these meta data collection activities are now subject 
to the orders and supervision of the FISC. 

50. As noted above, starting in October 2001, and since 
2004 pursuant to the FISC Pen Register Order, the NSA collected bulk meta data associated with 
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pursuant to the FISC Telephone Records Order, certain telecommunication companies 

provide the NSA with bulk telephony meta data in the form of call detail records derived from 

information kept by those companies in the ordinary coinse of business. See T| 2 5, 27, supra. 

51 (TS/ZSt flOC/N F) The bulk meta data collection activities that have been 
undertaken by the NSA since 9/11 are vital tools for protecting the United States from another 
catastrophic terrorist attack. Disclosure of these meta data activities, sources, or methods would 
cause exceptionally grave harm to national security. It is not possible to target collection solely 
on known terrorist telephone identifiers and effectively discover the existence, location, and 
plans of terrorist adversaries. 









'he only effective means by which NS A analysis are able continuously] 
to keep track of such operatives is through meta data collection and analysis. 



Technical Details of Analytic Capabilities 
52. In particular, the bulk collection of Internet and telephony meta 

data allows the NSA to use critical and unique analytical capabilities to track the contacts®!!! 
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55. Because it is impossible to determine in advance 

which particular piece of meta data will turn out to identify a terrorist, collecting meta data in 
Iwlk is vita! for the success of contact-chaining NSA analysts know that the) 

terrorists’ telephone calls are located somewhere in the billions of data bits; what they cannot 
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know ahead of time is exactly where. The ability to accumulate meta data substantially increases 
NSA’s ability to delect and identify these targets. One particular advantage of bulk meta data 
collection is that it provides a historical perspective on past contact activity that cannot be 
captured in the present or prospectively. Such historical links may be vital to identifying new 
targets, because the meta data may contain links that are absolutely unique, pointing to potential 
targets that otherwise would be missed. 



The9e sources and methods enable the NS A to segregate some of that very 
small amount of otherwise undetectable but highly valuable information from the overwhelming 
amount of other information that has no intelligence value whatsoever — in colloquial terms, to 
find at least some of the needles hidden in the haystack. If employed on a sufficient volume of 



data, contact chaining 
that were previously unknown. 



expose 



and contacts 



56. fFS/ZShWF) The foregoing discussion is not hypothetical. As noted previously, 
since inception of the first FISC Telephone Business Records Order, NSA has provided 275 
reports to the FBI. These reports have provided a total of 2,549 telephone identifiers as being in 



contact with identifiers associated with 
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57. ( T - S // 8 l//0€/N F) Accordingly, adjudication of plaintiffs’ allegations concerning 

the collection of non-content meta data and records about communication transactions would risk 



or require disclosure of critical NSA sources and methods for 



contacts of 




terrorist communications as well as the existence of current NSA activities under FISC Orders. 
Despite media speculation about these activities, official confirmation and disclosure of the 
NSA’s bulk collection and targeted analysis of telephony meta data would confirm to all of our 



foreign adversaries 



e existence of these critical intelligence 



capabilities aod thereby severely undermine NSA’s ability to gather information concerning 
terrorist connections and cause exceptional harm to national security. 

2. (T S //SI//OC/NF ) Information Concerning Current FISA Authorized 
Activities and Specific FISC Orders. 

58. (TS //TSP // S I/ /O C//NF) 1 am also supporting the DNI’s state secrets privilege 
assertion, and asserting NSA's statutory privilege, over information concerning the various 
orders of the Foreign Intelligence Surveillance Court mentioned throughout this declaration that 
authorize NSA intelligence collection activities, as well as NSA surveillance activities conducted 
pursuant to the Protect America Act (“PAA”) and current activities authorized by the FISA 
Amendments Act of 2008. As noted herein, the three NSA intelligence activities initiated after 
the September 1 1 attacks to detect and prevent a further ol Qaeda attack — (i) content collection 
of targeted al Qaeda and associated terronsl-related communications under what later was called 
the TSP; (ii) internet meta data bulk collection; and (iij) telephony meta data bulk collection — 
have been subject to various orders of the FISC (as well as FISA statutory authority) and are no 
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longer being conducted under presidential authorization. The bulk collection of non-content 
transactional data for internet communications was first authorized by the FISC in the July 2004 
FISC Pen Register Order, and the bulk collection of non-content telephony meta data was first 
authorized by the FISC in May 2006. The existence and operational details of these orders, and 
of subsequent FISC orders reauthorizing these activities, remain highly classified and disclosure 
of this information would cause exceptional harm to national security. 25 In addition, while the 
Government has acknowledged the general existence of the January 10, 2007 FISC Orders 
authorizing electronic surveillance similar to that undertaken in the TSP, the content of those 



orders, and facts concerning the NS A sources and methods they authorize, cannot be disclosed 
without likewise causing exceptional harm to national security. Subsequent content surveillance 
sources and methods utilized by the NSA under the PAA and, currently, under the FISA 
Amendments Act of 2008 likewise cannot be disclosed. I summarize below the proceedings that 
have occurred under authority of the FISA or the FISC. 

59. (TS//S l/ZOCf/NF) (a) Internet Meta Data : Pursuant to the FISC Pen Register 
Order, which has been reauthorized approximately every 90 days after it was first issued, NSA is 



authorized to collect in bulk 



meta data associated with 



electronic communications 



fPS//S t//OC//N F) For this reason, the FISC Telephone Business Records Order and 
FISC Pen Register Orders prohibit any person from disclosing to any other person that the NSA 
has sought or obtained the telephony meta data, other than to (a) those persons to whom 
disclosure is necessary to comply with the Order; (b) an attorney to obtain legal advice or 
assistance with respect to the production of meta data in response to the Order; or (c) other 
persons as permitted by (he Director of the FBI or the Director’s designee. The FISC Orders 
further provide that any person to whom disclosure is made pursuant to (a), (b), or (c) shall be 
subject to the nondisclosure requirements applicable to a person to whom the Order is directed in 
the same manner as such person. 
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| The NS A is authorized to query the archived 
meta data collected pursuant to the FISC Pen Register Order using email addresses for which 
there were facts giving rise to a reasonable, articulable suspicion that the email 



address was associated with 



Order was most recently reauthorized on 



providers through 



The FISC Pen Registei 
12009, and requires continued assistance by the 



1 : Beginning ui May 2006, the NSA’s 



bulk collection of telephony meta data, previously subject to presidential authorization, was 
authorized by the FISC Telephone Business Records Order Like the FISC Pen Register Order, 
the FISC Telephone Business Records Order was reauthorized approximately every 00 days. 
Based on the finding that reasonable grounds existed that the production was relevant to efforts 
to protect against international terrorism, the Order required 
produce to the NSA “call detail records'’ or ‘lelephony metadata” pursuant to 50 U.S.C. § 

1 861 [c] (authorizing the production of business records for, inter alia, an investigation to protect 
against international terrorism). Telephony meta data was compiled from call detail data 
maintained by the providers in the ordinary course of business that reflected non-content 
information such as the date, time, and duration of telephone calls, as well as the phone numbers 
used 10 place and receive the calls. The NSA was authorized by the FISC to query the archived 
telephony meta data solely with identified telephone numbers for which thete were facts giving 
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rise to a reasonable, articulable suspicion that the number was associated with | 

(or a “RAS” determination). The FISC Telephone Business 
Records Order was most recently reauthorized on March 2, 2009, but subject to new specific 
limitations, which I summarize next. 

61. (T S //SI/ /O C ¥/Nfj As noted above (note 1 1 supra), on January 1 5, 2009, the 
Department of Justice (“DOJ 1 ') submitted a compliance incident report related to the Business 
Records Order to the FISC, based on information provided; to DOJ by the NSA, which indicated 
that the NSA’s prior reports to the FISC concerning implementation of the FISC Telephone 
Business Records Order had not accurately reported the extent to which NSA had been querying 
the telephony meta data acquired from carriers. In sum, this compliance incident related to a 
process whereby currently tasked telephony selectors (i.e. phone numbers) reasonably believed 
to be associated with authorized counter terrorism foreign intelligence targets associated with 

der Executive Order 12333 were reviewed against 
the incoming telephony metadata to determine if that number had been in contact with a number 
in the United States. This process occurred prior to a formal determination by NSA that 
reasonable articulable suspicion existed that the selector was associated with J 

and was not consistent with NSA’s prior descriptions of the 
process for querying telephony meta data. 

62. fTS/,'ST '/0€ - //N F) By Order dated March 2, 2009, the FISC has directed that the 
NSA may continue to acquire call detail records of telephony meta data in accordance with the 
FISC Telephone Business Record Orders, but is prohibited from accessing data acquired except 
in a limited manner. In particular, the Government may request through a motion that the FISC 
authorize querying of the telephony meta data for purposes of obtaining foreign intelligence on a 
case-by-case basis (unless otherwise necessary to protect against imminent threat to human life, 
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subject to report to the FISC the next business day). In addition, the FISC imposed other 
obligations on the Government, including to report on its ongoing review of the matter and to file 
affidavits describing the continuing value of the telephony meta data collection to the national 
security of the United Slates and to certify that the information sought is relevant to an 
authorized investigation, 

63, -fFS //T £ FV NS A is committed to working with the FISC 

on this and other compliance issues to ensure that this vital intelligence tool works appropriately 
and effectively. For purposes of this litigation, and the privilege assertions now made by the 
DN1 and by the NSA, the intelligence sources and methods described herein remain highly 

classified and the disc losure that I 



compromise vital NSA sources and methods and result in exceptionally grave harm to national 
security. 

64. (T S //T SPtfS I//OC//NF ) (c) Content Collection '. On January ]0, 2007, the FISC 
issued orders authorizing the Government to conduct certain electronic surveillance that had 

been occurring under the TSP Those Orders included® 



|the “Foreign Telephone and Email Order,” which 
authorized, inter alia, electronic surveillance of telephone and Internet communications 

where the Government determined that there was probable 
cause to believe that ( 1 ) one of the communicants is a membeT or agent of 

and (2) the communication is to or from a foreign country (/.e., 
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a one-end foreign communication to or from t^^nited States). Thereafter, any electronic 
surveillance that was occurring as part of the TSP became subject to the approval of the FISA 
Court and the TSP was not reauthorized. 27 

65. The Foreign Telephone and Email Order remained in effect 

until the Protect America Act (“PAA”) was enacted in August 2007. Under the PAA, the FISA’s 
definition of “electronic surveillance” was clarified to exclude “surveillance directed at a person 
reasonably believed to be located outside the United States.” 50 U.S.C. § 1 805A. The PAA 
authorized the DNI and the Attorney General to jointly “authorize the acquisition of 
foreign intelligence information concerning persons reasonably believed to be outside the 
United States" for up to one year, id. § 1805B(a), and to issue directives to communications 
service providers requiring them to “immediately provide the Government with all information, 
facilities, and assistance necessary to accomplish the acquisition” of necessary intelligence 



information, id. § 1805B(e). Such directives were issued and the NSA conducted 
content surveillance of overseas targets under the PAA 

66. (TS//5 1// O C/ NF) Beginning 2008, expiring directives that had been 

issued under the PAA for content surveillance of overseas targets (including surveillance of 



specificl 



Itargets overseas) were replaced by new directives for such surveillance 
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issued pursuant to the * l'' \ V-icn inciii •• \. t < j '<i*'s ’• *• iv I *•’- •: c f H V Amendment' Vet of 
2t« JS juihuri/es the targeting u| persons outside oj the 1 ruled States without ?mti \ idual f 1st 
orders Hut subject to ditcitiv es issued to earners hj the Diteciot of National Intelligence and the 
Attorney licrsei-d under Section 7i'2<ht ol'the USA tor tt>c continuation oj'.iver»eas stirveil lance 
under f hi ^ new auihonty Ac 5u 1 St i I X\ j jf h> (a> ijijeil h\ the I IS \ Act of 2<X)X. f* I 
l in->n 

fv7 -f hv i - SP:. ‘ vl COM '- ) In Mint, slur post 't ! ! content surveillance -leltv UK's 
under liken bv tile NS A evolved 1’rum ihepresidcnlially uulhonml I SI 1 In the r ISC’ loteign 
lekphone ami f majl Ordei, tti the directives issued under die !’ \ V and, ultimately, in the 
diTc-mesth.il -nc now heme issued puTsuant to the USA Amendments A*. t ut 2<)fiN. Facti 
mtlii'n/atioit sought to enable the NS A in undertake sutveilhutevnii numerous multiple lurgcls 
<n orseas vv ilhoul the need t<> obtain advance court approval I or cadi laigel. bid none lijs cniadcd 
till kind <>f tiidivcrimm-Uc lonictit >ui veilkinee on telephony and Internet eowmuni cations th.n 
tin pUimHfs allege 

.V. (U) Plaintiff:.' Allegations that A1 &T Provided Assistance to the NSA with 

the Alleged Activities. 

NX. (I’J Hie fluid niaiiir category oi NSA intelligence sources and methods as to 
winch I am supporting the DM's as'CfUoti ol privilege, and asserting the N.SAN statutory 
pnv ilcge. soreem- information that may lend !>■ cm I: mi «.ir deny whether or nt>i \ FN.T (or to tits 
extent necessary w hethei or iml .mv other tciceomnuinualioti' provider) has assisted the Ns A 
with alleged intelligence acliv dies Puinhtls allege that they are customers <»! A i <N t . and that 
A I N t puriicipalcd m the alleged surveillance ado Hits iix.it the pUtmt ill's seek to challenge As 
set tors 1 1 below, continuation or dent-i! o! j relationship between the SNA arid Mil (or other 
carr.tr- 1 ->n alleged intelligence act. vines would cause csigptionaik guw harm to national 






securi ty. 
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69. Because the NSA is not engaged in the 

indiscriminate dragnet of the content of domestic and international communications as the 
plaintiffs allege, 




On September 19, 2008, then- Attorney Genera! 

Mukasey submitted a classified declaration and certification to this Court authorized by Section 
802 of t he Foreign Intellig ence Surveillance Act Ame ndments Act o f 2 008. see 50 U.S.C. 

1885a 



Classified In Camera. Lx Parle Declaration of Deborah A. Sonanni, National Security Agency 
Carolyn Jewel, e/ at. v. National Security Agency, el at (No, 08-CV-48^-VRW) 



OR N 






Classified In Camera, Ex Pane Declarator! of Deborah A Brxianni, Naiional Security Agency 
Carolyn Jewel, el at. v. Notional Security Agency, el al. 









Classified In Camera, Ex Pane Dcclaralion of Deborah A. Bonanni, National Security Agency 
Carolyn Jewel, et ol v. National Security Agency, a ai q 







Classified In Camera. Ex Parle Declaration of Deborah A Bonanni, National Security Agency 
Carolyn Jewel, era!. r. National Security Agency- « at (No 08<v-d873-VRW) 

-T©p-8EeftET^r ' 



s' 



i 









77 . fFSHSimp) 






Classified In Camera. Ex Parte Declaration of Deborah A. Bonanni, National Security Agency 
Carolyn Jewel, eial . v National Security Agency, ei al. (No. O^^fST^RW) 

TO ! 1 SECIH r-P-t SfV^h^HH^^^ : /NOF0R-N- 



52 



i 








8 









VII. (U) Risks of Allowing Litigation to Proceed 
80. Upon examination of (he allegations, claims, 

facts, and issues raised by this case, it is my judgment that sensitive state seaets are so central to 
the subject matter of the litigation that any attempt to proceed will substantially risk the 
disclosure of the privileged state secrets described above. Although plaintiffs’ alleged content 
surveillance dragnet does not occur, proving why that is so 



would directly implicate highly classified 
intelligence information and activities. Similarly, attempting to address plaintiffs’ allegations 
with respect to the bulk collection of non-content information and records containing 
transactional meta data about communications would also compromise currently operative NSA 
sources and methods that are essentia) to protecting national security, including for detecting and 
preventing a terrorist attack. 



myjudgmcnt, any effort to probe the outer-bounds of such classified information would pose 



35 (TS/ffSI¥> ^I//0€' f NF) In its prior classified declarations in this action, the NSA has 
set forth specific examples of how the intelligence sources and methods utilized by the NSA 
after the 9/1 1 attacks, including content surveillance under the TSP and pursuant to subsequent 
FISA authority, as well as non-content meta data collection and analysis, have led to the 
development by the NSA of actionable intelligence and important counter-terrorism efforts. See. 
e.g., Classified In Camera^ Ex Parte Declaration of LTG Keith B. Alexander in Shuberl, el a!, v. 
Bush, ei al„ (Case No. 07-cv-693) (dated May 25,2007) at 35-43, 58-61, To the extent that 

such information would be relevant to any litigation in this action, however, they could not be 
disclosed without revealing specific NSA intelligence information, sources, and methods, and are 
subject to the government’s privilege assertion 
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inherent and significant risks of the disclosure of that information, including critically sensitive 



information about NSA sources, methods, operations, targets 



Indeed, any 



effort merely to allude to those facts in a non-classified fashion could be revealing of classified 
details that should not be disclosed. Even seemingly minor or innocuous facts, in the context of 
this case or other non-classified information, can tend to reveal, particularly to sophisticated 
foreign adversaries, a much bigger picture of U.S. intelligence gathering sources and methods. 

8 1 . (-T&VS-fcWF) The United States has an overwhelming interest in detecting and 
thwarting further mass casualty attacks by a) Qaeda. The United States has already suffered one 
attack that killed thousands, disrupted the Nation’s financial center for days, and successfully 
struck at the command and control center for the Nation’s military. A1 Qaeda continues to 
possess the ability and clear, stated intent to carry out a massive attack in the United States that 
could result in a significant loss of life, as well as have a devastating impact on the U.S. 
economy. According to the most recent intelligence analysis, attacking the U.S. Homeland 
remains one of al Qaeda’s top operational priorities, see Classified In Camera Ex Parle 
Declaration of Admiral Dennis C. Blair, Director of National Intelligence, and al Qaeda will 
keep trying for high-impact attacks as long as its central command structure is functioning and 
affiliated groups are capable of furthering its interests 

82. fFSWS V /N F ) Al Qaeda seeks to use our own communications infrastructure 
against us as they secretly attempt to infiltrate agents into the United States, waiting to attack at a 
time of their choosing. One of the greatest challenges the United States confronts in die ongoing 
effort 10 prevent another catastrophic terrorist attack against the Homeland is the critical need to 
gather intelligence quickly and effectively. Time is of the essence in preventing terrorist attacks, 
and the government faces significant obstacles in finding and tracking agents of al Qaeda as they 
manipulate modem technology in an attempt to communicate while remaining undetected. The 
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NSA sources, methods, and activities described herein are vital tools in this effort. 

VUI. (U) Conclusion 

83. (U) In sum, l support the DNl’s assertion of the state secrets privilege and 

statutory privilege to prevent the disclosure of the information described herein and detailed 
herein. I also assert a statutory privilege under Section 6 of the National Security Act with 
respect to the information described herein which concerns the functions of the NSA. Moreover, 
because proceedings in this case risk disclosure of privileged and classified intelligence-related 
information, 1 respectfully request that the Court not only protect that information from 
disclosure but also dismiss this case to prevent exceptional harm to the national security of the 
United Stales. 

1 declare under penalty of perjury that the foregoing is true and correct. 



DATE: 




DEBORAH A. BONANNI 
Chief of Staff 
National Security Agency 
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